Cyber Resilience

Threat actor · all actors

EquationG0020 state

🇺🇸 US · NSA · TAO

aka Equation, Equation Group, Tilded Team, EQGRP, G0020

Last updated: 2026-08-21

3attributed CVEs
7ATT&CK techniques
11.1IDF score (tooling uniqueness)
1exclusive CVEs
2010–2022years active

About this actor

[Equation](https://attack.mitre.org/groups/G0020) is a sophisticated threat group that employs multiple remote access tools. The group is known to use zero-day exploits and has developed the capability to overwrite the firmware of hard disk drives. (Citation: Kaspersky Equation QA)

Source: MITRE ATT&CK

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

MITRE ATT&CKG-number catalogue id

G0020

Unclassifiedno scheme matched

EquationEquation GroupTilded TeamEQGRP

How we know this

Data origin
MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
Techniques
MITRE ATT&CK STIX mappings — 7 ATT&CK techniques on file.
Named victims
None on file.

See how actor data is built for the full pipeline.

Activity timeline

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2013-3894 8.78.10.93122013-10-09see CVE
CVE-2010-2568 KEV8.57.80.97342010-07-22see CVE
CVE-2012-0159 8.00.00.85682012-05-09see CVE

Mitigating controls (NIST 800-53)

ControlTechniques coveredCoverage
AC-21 / 714%
AC-31 / 714%
AC-51 / 714%
AC-61 / 714%
CM-21 / 714%
CM-31 / 714%
CM-51 / 714%
CM-61 / 714%
CM-81 / 714%
IA-21 / 714%
IA-71 / 714%
IA-81 / 714%
RA-91 / 714%
SA-101 / 714%
SA-111 / 714%

Co-occurring actors

Similar actors

Similar TTPs

Overlapping CVEs

Active in same years

Same nation-state

Same category